Black-Box Constructions of Concurrently Secure Protocols Huijia (Rachel) Lin Rafael Pass MIT & BU Cornell
Secure MPC
Secure MPC Goal: Allow a set of distrustful parties to compute ANY function f on their own
Secure MPC Goal: Allow a set of distrustful parties to compute ANY function f on their own
Secure MPC Goal: Allow a set of distrustful parties to compute ANY function f on their own Correctness What to get---the outputs Privacy What to hide---the private inputs
Secure MPC Goal: Allow a set of distrustful parties to compute ANY function f on their own Correctness What to get---the outputs Privacy What to hide---the private inputs Even when no honest majority
Simulation Paradigm REAL IDEAL
Simulation Paradigm REAL IDEAL “as correct & private as”
Simulation Paradigm REAL IDEAL “as correct & private as”
Simulation Paradigm REAL IDEAL A R “as correct & private as”
Simulation Paradigm REAL IDEAL A I A R “as correct & private as”
Simulation Paradigm REAL IDEAL Simulator A I A R “as correct & private as”
Simulation Paradigm REAL IDEAL Simulator A I A R x 1 y 1 x 2 y 2 x 1 y 1 x 2 y 2 “as correct & private as” Correctness: The output of every player in ideal is the same as in real
Simulation Paradigm REAL IDEAL Simulator A I A R x 1 y 1 x 2 y 2 x 1 y 1 x 2 y 2 “as correct & private as” Correctness: The output of every player in ideal is the same as in real Privacy: The simulator can learn whatever the adv learns
Simulation Paradigm REAL IDEAL Simulator A I A R x 1 y 1 x 2 y 2 x 1 y 1 x 2 y 2 “as correct & private as” Correctness: The output of every player in ideal is the same as in real Privacy: The simulator can learn whatever the adv learns
Simulation Paradigm REAL IDEAL Simulator A I A R x 1 y 1 x 2 y 2 x 1 y 1 x 2 y 2 “as correct & private as” Correctness: The output of every player in ideal is the same as in real Privacy: The simulator can learn whatever the adv learns In this talk, we focus on static malicious corruption
The Concurrent Model
The Concurrent Model MANY sets of players executing MANY different protocols all at once [DDN, DNS, GK, Fe, KPR, RK, CKPR, KP, PRS, C...and many others]
The Concurrent Model MANY sets of players executing MANY different protocols all at once [DDN, DNS, GK, Fe, KPR, RK, CKPR, KP, PRS, C...and many others]
Concurrent Security (informally) REAL IDEAL Many executions of Many executions with different protocols INDEPENDENT trusted parties
Concurrent Security (informally) REAL IDEAL Universal Composibility (UC) [Can00] Many executions of Many executions with different protocols INDEPENDENT trusted parties
Concurrent Security (informally) REAL IDEAL Universal Composibility (UC) [Can00] Impossible [CF01, CKF03] Many executions of Many executions with different protocols INDEPENDENT trusted parties
Super Polynomial Time Simulation ( SPS ) REAL IDEAL
Super Polynomial Time Simulation ( SPS ) REAL IDEAL — SPS [Pas03, BS05, LPV09, GGJS12]
Super Polynomial Time Simulation ( SPS ) REAL IDEAL — SPS [Pas03, BS05, LPV09, GGJS12]
Super Polynomial Time Simulation ( SPS ) REAL IDEAL — SPS [Pas03, BS05, LPV09, GGJS12] — Angel-based Security Model [PS04, MMY06] — UC with super-poly helpers [CLP10]
Super Polynomial Time Simulation ( SPS ) REAL IDEAL Feasibility Results Only — SPS [Pas03, BS05, LPV09, GGJS12] — Angel-based Security Model [PS04, MMY06] — UC with super-poly helpers [CLP10]
Super Polynomial time (SPS) Security Feasibility Results Only Due to the Non-Black-Box constructions ( Lots of Karp reductions)
Super Polynomial time (SPS) Security Feasibility Results Only Naturally, Solution: Black-box Constructions ( No Karp reductions)
Super Polynomial time (SPS) Security Feasibility Results Only Naturally, Solution: Black-box Constructions ( No Karp reductions) Efficient Protocols
BB MPC Protocols
BB MPC Protocols In the stand alone setting---Solved! O(1) round BB MPC, f/ minimal assumption semi-honest OT [Kil88,IPS08,IKLP06,Hai08,Wee10,Goy11]
BB MPC Protocols In the stand alone setting---Solved! O(1) round BB MPC, f/ minimal assumption semi-honest OT [Kil88,IPS08,IKLP06,Hai08,Wee10,Goy11] In the concurrent setting Only unconditionally secure UC protocols f/ strong set-ups e.g. Ideal OT [Kil88,IPS08], hardware tokens [GISVW10]
BB MPC Protocols In the stand alone setting---Solved! O(1) round BB MPC, f/ minimal assumption semi-honest OT [Kil88,IPS08,IKLP06,Hai08,Wee10,Goy11] In the concurrent setting Only unconditionally secure UC protocols f/ strong set-ups e.g. Ideal OT [Kil88,IPS08], hardware tokens [GISVW10] Can we have BB concurrently secure protocols in the plain model?
Yes! Our Result (informal) : BB construction of concurrently secure MPC protocols • In the plain model • Based on minimal assumption Semi-Honest OT • Security in the UC with super-poly helper model • Implies super-polynomial time simulation security • Closed under universal composition
Yes! Our Result (informal) : BB construction of concurrently secure MPC protocols • In the plain model • Based on minimal assumption Semi-Honest OT • Security in the UC with super-poly helper model • Implies super-polynomial time simulation security • Closed under universal composition How?
Any Functionality [Kil88,IPS08,GMW87,BGW88]: Unconditional UC-security Ideal Oblivious Transfer Box F OT
Any Functionality [Kil88,IPS08,GMW87,BGW88]: Unconditional UC-security Ideal Oblivious Transfer Box F OT BB Stand-alone Semi-honest OT SH-OT
Any Functionality [Kil88,IPS08,GMW87,BGW88]: Unconditional UC-security Ideal Oblivious Transfer Box F OT [IKLP06,Hai08,Wee10,Goy11] BB Stand-Alone Security Stand-alone Semi-honest OT SH-OT
Any Functionality [Kil88,IPS08,GMW87,BGW88]: Unconditional UC-security Ideal Oblivious Transfer Box F OT This work [IKLP06,Hai08,Wee10,Goy11] BB Stand-Alone Security UC with Super-Poly Helper Stand-alone Semi-honest OT SH-OT
Any Functionality [Kil88,IPS08,GMW87,BGW88]: Unconditional UC-security Ideal Oblivious Transfer Box F OT This work [IKLP06,Hai08,Wee10,Goy11] BB Stand-Alone Security UC with Super-Poly Helper Stand-alone Semi-honest OT SH-OT The main tool: BB CCA-Secure Commitments [CLP10]
CCA-Secure Commitments
CCA-Secure Commitments The commitment analogue of CCA2 encryption.
CCA-Secure Commitments The commitment analogue of CCA2 encryption. C(y 3 ) A O C( x ) C(y 1 ) C(y 2 )
CCA-Secure Commitments The commitment analogue of CCA2 encryption. C(y 3 ) y 3 A O C( x ) C(y 1 ) y 1 C(y 2 ) y 2 O is a committed-value oracle If valid com, y = the committed value Else if invalid com, y = bot
CCA-Secure Commitments The commitment analogue of CCA2 encryption. C(y 3 ) y 3 A O C( x ) C(y 1 ) y 1 C(y 2 ) y 2 O is a committed-value oracle If valid com, y = the committed value Else if invalid com, y = bot Note: Original definition in [CLP10] considers a decommitment oracle. (with black-box construction, we can only achieve the weaker notion.)
CCA-Secure Commitments The commitment analogue of CCA2 encryption. C(y 3 ) y 3 A O C( x ) C(y 1 ) y 1 C(y 2 ) y 2 Chosen-Commitment-Attack (CCA) security: Either A forwards the left commitment to the right LHS is hiding --- view of A indistinguishable Or
Concurrent Non-Malleable Commitments C(y 3 ) A C( x ) C(y 1 ) C(y 2 )
Concurrent Non-Malleable Commitments C(y 3 ) A C( x ) C(y 1 ) C(y 2 ) Non-Malleability Either A copies the left commitment to the right Or x and (y 1 , y 2 , y 3 ) independent --- view of A + (y 1 , y 2 , y 3 ) indistinguishable
Concurrent Non-Malleable Commitments C(y 3 ) A C( x ) C(y 1 ) C(y 2 ) O y 1 y 3 y 2 Non-Malleability Either A copies the left commitment to the right Or x and (y 1 , y 2 , y 3 ) independent --- view of A + (y 1 , y 2 , y 3 ) indistinguishable
Concurrent Non-Malleable Commitments C(y 3 ) A C( x ) C(y 1 ) C(y 2 ) O y 1 y 3 y 2 Non-Malleability Either A copies the left commitment to the right Or x and (y 1 , y 2 , y 3 ) independent --- view of A + (y 1 , y 2 , y 3 ) indistinguishable CCA security Non-Malleability
Theorem 1: OWF BB construction of CCA commitments
Theorem 1: OWF BB construction of CCA commitments Theorem 2: CCA commitments + SH-OT BB implementation of F OT
Theorem 1: OWF BB construction of CCA commitments Proof: [CLP10]---Non-BB CCA commitments + [PW08]---BB trapdoor commitments + [CDMW08,09]---Cut & choose for consistency Theorem 2: CCA commitments + SH-OT BB implementation of F OT
Theorem 1: OWF BB construction of CCA commitments Proof: [CLP10]---Non-BB CCA commitments + [PW08]---BB trapdoor commitments + [CDMW08,09]---Cut & choose for consistency Theorem 2: CCA commitments + SH-OT BB implementation of F OT
Theorem 2: CCA commitments + SH-OT BB implementation of F OT
Recommend
More recommend
